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DETAILED ACTION 

1. In an amendment filed on November 02, 2009, claims 1,4-5, 7-9, 12, 14-16 and 18-20 have been 

amended. 

2. Claims 2-3, 6, 10-11, 13, 17 and 21-22 have been cancelled. 

3. Claim 23 has been added. 

4. Claims 1,4-5, 7-9, 12, 14-16, 18-20 and 23 are pending. 

Response to Arguments 

5. Applicant's arguments filed on September 15, 2008, with respect to the rejection of claims 1 , 4-5, 
7-9, 12, 14-16 and 18-20 have been fully considered in view of the remarks and amendment to claims 
and are persuasive. The rejections of claims 1, 4-5, 7-9, 12, 14-16 and 18-20 have been withdrawn. 

Claim Objections 

6. Claim is objected to because of the following informalities: The comparison module of the claim 1 
is repeatedly claimed in paragraph 4 and 6 of claim 1 . Applicant authorized the examiner to amend this 
claim in the examiner amendment. 

Allowable Subject Matter 

7. Claims 1, 4-5, 7-9, 12, 14-16, 18-20 and 23 are allowed. No reason for allowance is needed as 
the record is clear in light of applicant's arguments and specification. 

EXAMINER'S AMENDMENT 

8. An examiner's amendment to the record appears below. Should the changes and/or additions be 
unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure 
consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee. 
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Authorization for this examiner's amendment was given in a telephone interview with applicant 
representative, Jens C. Jenkins (Reg. No. 44,803), on December 17, 2009. The following amendment to 
claim 1 will replace the previous claim 1 . 

1 . (Currently Amended) A computer-implemented malware detection system for determining 
whether an executable script is malware according to i ts functionality, functional variables and 
subroutines of the executable script, the malware detection system comprising: 

a malware signature store including at least one known malware script signature, wherein 
each malware signature in the malware signature store is a normalized signature of a known malware 
script; [[and]] 

a normalization module that obtains an executable script and generates a normalized 
signature for the executable script, wherein generating a normalized signature for the executable script 
comprises normalizing tok e ns variables and subroutines f rom the executable script into normalized 
tok e ns variables and subroutines conforming to a common format suitable for comparison with that at 
least one malware signature in the malware signature store, the normalizing comprising renaming 
variables and subroutines from the executable script according to a common naming convention: and 

a comparison module, wherein the comparison module compares the normalized 
signature of the executable script to the at least one normalized malware signature in the malware 
signature store: 

wherein the malware detection system is configured to: 

compare the norma li zed s i gnature of tho oxooutab l o scr i pt to the at l east one norma li zed 
ma l war e s i gnatur e i n th e ma l war e s i gnatur e stor e to d e t e rm i n e wh e th e r th e e x e cutab le scr i pt i s ma l war e ; 
and r e port wh e th e r th e e x e cutab le scr i pt i s ma l war e accord i ng to th e d e t e rm i nat i on, compr i s i ng 
det e rm i n i ng determine whether the comparison found a complete match between the normalized 
signature for the executable script and the at least one normalize malware signature, and if so. reporting 
that the executable script is malware. 
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Conclusion 

Any inquiry concerning tliis communication or earlier communications from tlie examiner sliould 
be directed to TESHOME HAILU whose telephone number is (571)270-3159. The examiner can normally 
be reached on Mon-Fri 7:30a.m. to 5:00p.m. EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Kambiz Zand can be reached on (571 ) 272-381 1 . The fax phone number for the organization where this 
application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained from 
either Private PAIR or Public PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) 
at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative 
or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272- 
1000. 

/Teshome Hailu/ 
Examiner, Art Unit 2434 
/Kambiz Zand/ 

Supervisory Patent Examiner, Art Unit 2434 



